Can an agent give itself more access?

No. No tool reads or writes an access policy, so an agent cannot widen itself, narrow itself, or inspect what another agent is allowed. Access is only ever changed by a person in the console.

Can an agent read my secrets?

No. Tools that touch configuration or the vault return names only. There is no tool that reveals a secret value, on any plan, at any access level.

What happens when an agent asks to destroy something?

The call is parked as an approval and the tool returns a pending result rather than acting. You approve or refuse it like any other approval; approving runs the action under you, and an untouched request expires after 24 hours.

Where do I change what an agent may do?

Open the environment to set the ceiling for every agent on it, or open a single agent to narrow it further. A template carries the default that new agents start with.

How do I cut an agent off immediately?

Switch its groups off, which takes effect on its next call, or rotate its platform token so the credential it holds stops working.

qoren.

Docs · Platform MCP

The Qoren platform MCP.

Every agent Qoren deploys is handed one extra tool server: Qoren itself. Through it an agent can look at itself, message the agents beside it, operate your fleet, and read your account usage. Nothing beyond reading itself is on until you switch it on, and the environment an agent runs on sets the maximum it can ever be given.

What it is

The platform MCP is a hosted Model Context Protocol server run by Qoren, not a package installed on your environment. Your agent connects to it over HTTPS with a token that belongs to that one agent, and the tools it sees are exactly the tools you allowed. It is the same server for every runtime, so an OpenClaw agent, a Hermes agent, a Codex agent and a Claude Code agent all reach it the same way.

The server is remote and stateless: every call re-reads your current access policy, so a switch you flip takes effect on the agent's next call.
Listing is filtered per agent. A tool you did not allow is not merely refused, it is not offered, so the agent never plans around a capability it does not have.
Secret values are never exposed. Tools that touch configuration return the NAMES of injected secrets and nothing else.

How the agent gets its token

Qoren mints a token per agent and writes it into that agent's environment file at setup, and again on every reprovision and move. The MCP entry is written into the agent's runtime configuration at the same time, referencing the token by variable rather than inlining it, so the credential never lands in a config file you would read or share.

1Deploy or reprovision the agentThe control plane mints a fresh token, stores only its hash, and writes the value into the agent's .env alongside the MCP server entry.
2The runtime connects at startupEach supported runtime renders the same entry in its own format and sends the token as a bearer credential with the agent's id.
3Rotate whenever you wantRotate platform token on the agent's page mints a new one and rewrites the file through a configure job. The previous token stops working immediately.

The five capability groups

Access is set by group for speed and by tool for precision. A group switch turns its whole set on; switching one tool off inside an on group leaves the rest alone. Groups are the same everywhere: on an environment, on a single agent, and as the default carried by a template.

Itself. Always on and never switchable. The agent can read its own identity, environment, configuration, logs and telemetry, and post a status line the console shows.
Teammates. Discover the other agents on the same environment and send them messages.
Mail. Adds no Qoren tools. Switching it on attaches the agent's own mailbox server so it can read and send its email.
Fleet. Inspect and operate your environments, agents, jobs and templates. The destructive half asks a human first.
Account. Read usage, spending and plan entitlements. No billing details, no payment data.

The environment is the ceiling

Two switches decide every call. The environment says what the agents standing on it may ever do; the agent's own policy can only narrow that. If Fleet is off on the environment, switching it on for one agent there changes nothing, and the console shows those tools as disabled by the environment rather than pretending they are available.

Environment policy is authoritative once set, so widening an agent past it is not possible from any surface.
A template carries a default policy, not a ceiling. It decides what a new agent starts with; the environment still decides the maximum.
An agent that creates another agent cannot choose its access. The new agent gets the template default, or reading itself only.
Agents can never read or change an access policy, their own included.

Approvals, audit and rate limits

Anything that destroys or rebuilds goes to a person. When an agent calls one of those tools, the call is parked in the same approval queue your agents already use for risky actions, and the tool returns a pending result instead of acting. A human approves or refuses; approval runs the action under the approver, and an untouched request expires after 24 hours.

Every write is recorded in the account log with the actor type agent and the agent's id. Reads are not recorded.
Each agent gets 60 platform calls per minute. Past that the server refuses further calls until the window rolls over.
Plan limits apply to anything an agent creates, exactly as they do when you create it yourself, and are re-checked when an approved action finally runs.

Every tool, by group

The full set the platform MCP can offer. Write marks a tool that changes something and is recorded in your account log; Asks a human marks one that is parked for approval instead of running.

Tool	Group	What it does	Write	Asks a human
self_whoami	Itself	Return this agent's name, runtime, model, template and current state.	No	No
self_environment	Itself	Return the environment it runs on: size, region, status and the peers on it.	No	No
self_config	Itself	Return its configuration: tasks, MCP servers, gateways and the names of injected secrets.	No	No
self_logs	Itself	Read a slice of its own recent runtime log output.	No	No
self_telemetry	Itself	Read its own recent activity and resource telemetry.	No	No
self_report_status	Itself	Post a short status line, and optional progress, that the console shows.	Yes	No
list_teammates	Teammates	List the other agents on this environment that can be messaged.	No	No
send_to_teammate	Teammates	Send a message to another agent on the same environment.	Yes	No
fleet_list_environments	Fleet	List the account's environments with size, region and status.	No	No
fleet_get_environment	Fleet	Read one environment in detail, including the agents on it.	No	No
fleet_list_agents	Fleet	List the account's agents across every environment.	No	No
fleet_get_agent	Fleet	Read one agent in detail: runtime, model, template, state and configuration.	No	No
fleet_list_jobs	Fleet	List recent control plane jobs and their status.	No	No
fleet_get_job	Fleet	Read one job in detail, including its events and any failure reason.	No	No
fleet_list_secret_names	Fleet	List the names of the account's vault secrets. Values are never returned.	No	No
fleet_list_templates	Fleet	List the account's agent templates.	No	No
fleet_get_template	Fleet	Read one agent template in detail.	No	No
fleet_create_environment	Fleet	Provision a new environment on the account's plan.	Yes	No
fleet_create_agent	Fleet	Deploy a new agent from a template onto an environment.	Yes	No
fleet_configure_agent	Fleet	Change another agent's configuration, such as its model or scheduled tasks.	Yes	No
fleet_message_agent	Fleet	Send a message to any agent on the account, not just peers on this environment.	Yes	No
fleet_cancel_job	Fleet	Cancel a queued or running control plane job.	Yes	No
fleet_destroy_environment	Fleet	Tear down an environment and everything on it.	Yes	Yes
fleet_destroy_agent	Fleet	Remove an agent from its environment.	Yes	Yes
fleet_resize_environment	Fleet	Move an environment to a different size, which reboots it.	Yes	Yes
fleet_reprovision_agent	Fleet	Rebuild an agent from its template on the same environment.	Yes	Yes
fleet_move_agent	Fleet	Move an agent to a different environment.	Yes	Yes
account_usage	Account	Read the account's usage for the current period.	No	No
account_spending	Account	Read the account's recorded spending for the current period.	No	No
account_entitlements	Account	Read what the plan allows, such as environment and agent limits.	No	No

Frequently asked questions

Read itself, and nothing more. Teammates, Mail, Fleet and Account are all off until you switch them on, either on the environment or through the template the agent was deployed from.

See it with a real agent.

The fastest way to understand the flow is to deploy a template and watch its first run.

Start free trial

The Qoren platform MCP.

What it is

How the agent gets its token

The five capability groups

The environment is the ceiling

Approvals, audit and rate limits

Every tool, by group

Frequently asked questions

Keep reading

Secrets and isolation

Deploy your first agent

The Qoren CLI

See it with a real agent.